rpm package
suse/go1.15&distro=SUSE Linux Enterprise Server 15 SP1-BCL
pkg:rpm/suse/go1.15&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-36221 | Med | 5.9 | < 1.15.15-1.39.1 | 1.15.15-1.39.1 | Aug 8, 2021 | Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. | |
| CVE-2021-33198 | Hig | 7.5 | < 1.15.13-1.33.1 | 1.15.13-1.33.1 | Aug 2, 2021 | In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. | |
| CVE-2021-33197 | Med | 5.3 | < 1.15.13-1.33.1 | 1.15.13-1.33.1 | Aug 2, 2021 | In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. | |
| CVE-2021-33196 | Hig | 7.5 | < 1.15.13-1.33.1 | 1.15.13-1.33.1 | Aug 2, 2021 | In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. | |
| CVE-2021-33195 | Hig | 7.3 | < 1.15.13-1.33.1 | 1.15.13-1.33.1 | Aug 2, 2021 | Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. | |
| CVE-2021-27918 | Hig | 7.5 | < 1.15.10-1.25.1 | 1.15.10-1.25.1 | Mar 11, 2021 | encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method. | |
| CVE-2021-3115 | Hig | 7.5 | < 1.15.7-1.17.1 | 1.15.7-1.17.1 | Jan 26, 2021 | Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download). | |
| CVE-2021-3114 | Med | 6.5 | < 1.15.7-1.17.1 | 1.15.7-1.17.1 | Jan 26, 2021 | In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field. |
- affected < 1.15.15-1.39.1fixed 1.15.15-1.39.1
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
- affected < 1.15.13-1.33.1fixed 1.15.13-1.33.1
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
- affected < 1.15.13-1.33.1fixed 1.15.13-1.33.1
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
- affected < 1.15.13-1.33.1fixed 1.15.13-1.33.1
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
- affected < 1.15.13-1.33.1fixed 1.15.13-1.33.1
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
- affected < 1.15.10-1.25.1fixed 1.15.10-1.25.1
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
- affected < 1.15.7-1.17.1fixed 1.15.7-1.17.1
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
- affected < 1.15.7-1.17.1fixed 1.15.7-1.17.1
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.